GitHub Copilot: Advanced

Advanced

At this level Copilot stops being something you prompt line by line and starts doing multi-step work on its own. The skill shifts from writing prompts to setting up guardrails: a plan, the right tools, and a verification step you trust.

Plan before you build

The single biggest quality lever is separating planning from coding. VS Code ships a built-in Plan agent: run /plan <task>, or press ⌃⌘I (Ctrl+Alt+I) and pick Plan from the agents dropdown. It researches your codebase, asks clarifying questions, and produces a plan with implementation and verification steps. Iterate on the plan before any code changes (it’s saved to /memories/session/plan.md), then hand it to agent mode to implement.

Agent mode

Agent mode runs a real loop: it builds a prompt, calls tools (edit files, run terminal commands), reads the output (compile errors, lint, test results, the Problems panel), and corrects itself, repeating until the task is done or it hits a limit. This is how AI coding tools work at full extension.

By default it pauses for approval before editing files or running terminal commands. Read what it proposes before approving.

Caution

Blanket auto-approval widens the gap between trust and verify. If you want fewer prompts, auto-approve specific safe commands with the chat.tools.terminal.autoApprove setting: exact commands or /regex/ patterns set to true, plus explicit deny rules set to false (a false match always requires manual approval). Don’t turn on blanket auto-approve.

Note

One caveat for sensitive repos: agent mode and the cloud coding agent do not honor content-exclusion rules. They get full checkout access, even to excluded paths. (Copilot Code Review does respect exclusions, per GitHub’s content-exclusion docs.) Don’t rely on exclusions to hide secrets from the agent.

Several models offer an extended 1M-token context window in VS Code and the CLI, useful for large tasks. They consume more credits, and the model roster shifts often, so check the live picker rather than assuming.

Add tools with MCP

Model Context Protocol servers give Copilot new tools: a database, an issue tracker, your internal APIs.

1. Create .vscode/mcp.json in your workspace, or open the user config via MCP: Open User Configuration.

2. Add the server entry.

3. Approve the trust prompt when Copilot picks it up.

Caution

Local MCP servers run arbitrary code on your machine, and starting a server directly from mcp.json skips the trust prompt. Only add servers you trust. In an org, admins can restrict this to a registry allowlist (“Registry only” instead of “Allow all”).

Reuse prompts and agents

Two file types turn one-off prompting into versioned assets your whole team shares through the repo.

Prompt files: *.prompt.md

Prompt files (default location .github/prompts) store reusable prompts you invoke as slash commands. A release-notes prompt at .github/prompts/release-notes.prompt.md:

.github/prompts/release-notes.prompt.md

---
description: "Draft release notes from the changes since the last tag"
agent: agent
tools: ['search/codebase']
---
Draft release notes for version ${input:version}.
Group entries under Added / Changed / Fixed.
Match the tone and format of CHANGELOG.md.
Flag anything that looks like a breaking change.

Type /release-notes in chat to run it; ${input:version} asks for the value. Anything you’d otherwise paste from a snippets file belongs here.

Custom agents: *.agent.md

Agent files in .github/agents define custom agents: their own instructions, tool set, and model, selectable from the agents dropdown. Frontmatter takes name, description, tools, model, and handoffs; reference tools in the body as #tool:<name>. A read-only reviewer at .github/agents/reviewer.agent.md:

.github/agents/reviewer.agent.md

---
name: reviewer
description: "Reviews changes against project conventions without editing"
tools: ['search/codebase', 'search/usages']
handoffs:
  - label: Fix the findings
    agent: agent
    prompt: Fix the issues raised in the review above.
---
You are a strict code reviewer. Never edit files.
Check every change against the conventions you find with #tool:search/codebase.
Report findings as a numbered list: severity, file, line, and why it matters.

The handoffs entry offers a one-click transition to the default agent to implement the fixes, so review and repair stay separate steps.

Copilot Code Review

Get a review pass before a human looks.

• In VS Code: the Copilot Code Review button next to CHANGES in Source Control reviews your uncommitted changes; results show inline and in the Problems tab.
• On GitHub.com: add Copilot as a reviewer on a pull request.

Caution

Copilot’s PR review always leaves a Comment review, never Approve or Request changes. It doesn’t count toward required approvals and cannot block a merge. Treat it as a fast first pass, not the gate. Human review plus your own tests stay the real check. See Verification.

Copilot CLI

Copilot also runs in the terminal as a scriptable agent. It ships with the GitHub MCP server preconfigured, reads your instruction files, and can branch, implement, and open a PR in one flow.

Slash command	What it does
/model	Switch model
/mcp	Manage MCP servers
/skills	Manage Agent Skills
/plugin	Manage plugins
/settings	Open settings
/theme	Change theme

For non-interactive runs you can enable auto-approval (/yolo or /autoApprove), with the same caution as in the IDE.

You’re done when…

• ✅ You’ve planned a task with /plan, then implemented it in agent mode, approving each step
• ✅ You’ve added an MCP server via .vscode/mcp.json
• ✅ Your repo has at least one .prompt.md or .agent.md file the team actually uses
• ✅ You’ve run Copilot Code Review and know it can’t block a merge
• ✅ You’ve tried a task from the Copilot CLI

Next step

Ready to hand work to the autonomous cloud agent, run sessions in parallel, and govern Copilot across an org?

GitHub Copilot: Expert The cloud coding agent, parallel sessions, memory, and org governance.